A network abnormal traffic detection method based on the combination of snmp and netflow

Abstract

The invention relates to a network abnormality detection method, in particular to a network abnormal flow detection method based on the combination of SNMP and NetFlow. The present invention includes: (1) NetFlow data acquisition and processing: the NetFlow monitoring program scans the data tables in the preprocessing database in real time, adopts a flow detection method based on NetFlow, detects whether the information in the preprocessing database is abnormal, and reports to the monitoring system if there is any abnormality. The program submits the IP address and protocol number of the abnormal information; (2) SNMP management program analyzes the abnormality. The invention reduces the rate of false alarms; adopts the NetFlow preprocessing method, processes the collected large amount of data through four methods, and finally divides them into multiple statistically significant data tables, which improves the scanning speed for the subsequent detection method and reduces the calculation time. overhead.

Description

technical field [0001] The invention relates to a network abnormality detection method, in particular to a network abnormal flow detection method based on the combination of SNMP and NetFlow. Background technique [0002] With the rapid development of Internet technology, the network has changed from a traditional single network to a complex heterogeneous network. While people feel the convenience brought by the Internet, they also suffer from various intrusion threats from the Internet. Abnormal network traffic detection is an effective method to protect user equipment security. Currently, there are two commonly used network traffic detection methods: SNMP-based traffic detection technology and NetFlow-based traffic detection technology. [0003] SNMP (Simple Network Management Protocol) is the most widely used network management protocol. The network flow information collected based on SNMP includes: the number of input bytes, the number of input non-broadcast packets, t...

AI Technical Summary

Problems solved by technology

However, the NetFlow-based traffic detection technology also has some limitations. The data it collects is only statistically accurate, and the false positive rate is high.

[0005] Therefore, these two methods have great defects when used alone. The use of SNMP detection technology can make up for the shortcoming of low accuracy of NetFlow detection technology, and the use of NetFlow detection technology can make up for the shortcoming of small data capacity of SNMP detection technology.

Images